How do I create a CSR?

You should consider using the OpenSSL toolkit for the creation of certificate signing requests. OpenSSL comes pre-installed with most Linux distributions and MacOS X. The OpenSSL project also offers an OpenSSL for Windows download.

Once you have OpenSSL installed on your platform, use it to generate a CSR by typing:

openssl req -new -newkey rsa:2048 -keyout userkey.pem -out usercert_request.pem -subj /CN=bla

Note: If Confusa uses the Comodo-CA, the subject of the request can be arbitrary, as shown above, because Confusa will replace it with real values matching you, once it issues the certificate!

Which browsers are supported for browser requests

These browsers are not supported at the moment:


How to export certificates from the keystore

Firefox: Go to "Preferences/Advanced/Encryption/View Certificates/Your certificates". Then press "Backup" on the certificate you want to backup, which will create a PKCS#12 file on your harddisk. Then follow the steps here.
Opera: Go to "Preferences/Advanced/Security/Manage Certificates". Select your certificate and click "Export". Select PKCS#12 format. If you need the certificate for Grid submission, follow the steps here.
Internet Explorer: Go to "Internet options/Content/Certificates". Click the certificate you want to export and click "export". When asked, whether to include the private key, confirm the message. Select PKCS#12 format and "enable strong protection". If you need the certificate for Grid submission, follow the steps here.
Safari/Mac OS X: Your certificate should be automatically added to the keyring.
Chrome/Windows: It works the same way as with Internet Explorer.
Chrome/Linux: See the separate section for that topic.


How to convert between PKCS#12 and X.509

If you have a PKCS#12 certificate but want it in PEM format (e.g. for Grid job submission), do the following:

Private key:

openssl pkcs12 -nocerts -in cert.p12 -out ~user/.globus/userkey.pem


Public key:

openssl pkcs12 -clcerts -nokeys -in cert.p12 -out ~user/.globus/usercert.pem


Subsequently, give them the right permissions:

chmod 0600 userkey.pem
chmod 0644 usercert.pem


How to export certificates from the keystore (Chrome/Linux)

Instead of having it's own certificate management facilities, on Linux Google chrome ties into libnss3-tools. See the Chrome documentation on certificate management. On the downside, users will not have a very nice graphical interface to manage their certificates. On the other downside, the certutil command is not very easy to use. On the upside, it is rather powerful.

So after issuing a certificate, it can be checked whether it is present as one of the user's certificates:

certutil -d sql:$HOME/.pki/nssdb -L

Unfortunately the auto-generated cert id makes all cert operations an input-hazzle. List the details of a certificate:

certutil -d sql:$HOME/.pki/nssdb -L -n Confusa\ Test\ User\ Full\ Name\ aeoeaa\ confusatest@feide.no\'s\ TERENA\ eScience\ Personal\ CA\ ID

To export the certificate, from the NSS3 database, pk12util has to be used because certutil can only export the public key:

pk12util -d sql:$HOME/.pki/nssdb -o cert.p12 -n Confusa\ Test\ User\ Full\ Name\ aeoeaa\ confusatest@feide.no\'s\ TERENA\ eScience\ Personal\ CA\ ID

Now that the certificate has been exported in PKCS#12 format, it needs to be converted to PKCS#7 format in order to be used with the Globus/Grid software.

How to import CA certificates into Chrome

Importing the CA certificate (Windows)

Automatic import via the Chrome browser does not work. Instead the certificate has to be downloaded to the harddrive. Opening the browser options, navigating to "Under the hood" and clicking on the "Certificate Management" button, will bring up Windows' integrated certificate management. There the certificate can be imported.


Importing the CA certificate (Linux)

Our friend CertUtil will have to help us with importing again. First we download the CA-cert from the CA section of the portal and then we import it with certutil. -t T,c,c tells cert-util that the certificate can serve as a well CA for client certificates in SSL and is a valid CA for S/MIME and JAR.

certutil -d sql:$HOME/.pki/nssdb -A -n terena_escience_ca -t T,c,c -i TERENAeSciencePersonalCA.crt